# Top **URL:** https://discuss.elastic.co/top.md?page=134&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 135 --- ## [Logstash split one message into multiple](https://discuss.elastic.co/t/logstash-split-one-message-into-multiple/321496)
**Author:** [@mail2shanth](https://discuss.elastic.co/u/mail2shanth)\ **Replies:** 10\ **Last updated:** [December 20, 2022, 7:10pm UTC](https://discuss.elastic.co/t/logstash-split-one-message-into-multiple/321496 "2022-12-20T19:10:54Z")
Hi, I've the following message and I managed to create the output from only message, {"@timestamp":"2022-12-01T13:30:00.004Z","message":"\<190\>Dec 1 14:29:59 10.62.161.199 AA-AMG3U: 0950198238 NN \[MDA 8/4\]: LN44 SA 20… --- ## [APM .net agent see the Service Name in the logs for correlated transactions](https://discuss.elastic.co/t/apm-net-agent-see-the-service-name-in-the-logs-for-correlated-transactions/311137)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 14\ **Last updated:** [September 1, 2022, 8:17am UTC](https://discuss.elastic.co/t/apm-net-agent-see-the-service-name-in-the-logs-for-correlated-transactions/311137 "2022-09-01T08:17:09Z")
Kibana version: 7.16.3 (Docker) Elasticsearch version: 7.16.3 (Docker) APM Server version: 7.16.3 (Docker) APM Agent language and version: .net \ **Author:** [@pmk](https://discuss.elastic.co/u/pmk)\ **Replies:** 12\ **Last updated:** [October 15, 2020, 3:41pm UTC](https://discuss.elastic.co/t/snapshot-exception/251861 "2020-10-15T15:41:25Z") Hi i'm trying to take snapshot for every 30 min , The following problems occur. ERROR) { "type": "concurrent\_snapshot\_execution\_exception", "reason": "\[reponm-prd-snapshots:scheduled-lm\_rkid\_qtoa75fr0qvlca\] a snap… --- ## [Restore snapshots on a different environment](https://discuss.elastic.co/t/restore-snapshots-on-a-different-environment/225325)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 12\ **Last updated:** [April 2, 2020, 10:09pm UTC](https://discuss.elastic.co/t/restore-snapshots-on-a-different-environment/225325 "2020-04-02T22:09:11Z")
Hey All, I want to take a snapshot and restore on a different environment. What are the steps I should follow? I already created the snapshots on the original environment. I have multiple files created on each node (… --- ## [Logstash Monitoring API -](https://discuss.elastic.co/t/logstash-monitoring-api/213286)
**Author:** [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)\ **Replies:** 13\ **Last updated:** [January 5, 2020, 8:46am UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286 "2020-01-05T08:46:59Z")
Hi Guys! i have 3 logstash servers installed for my data pipeline. i have enabled the xpack.monitoring for each one of the servers, when i use Kibana and go to "Monitoring" tab, i see only one instance although i have … --- ## [Help with Logstash security features](https://discuss.elastic.co/t/help-with-logstash-security-features/183597)
**Author:** [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Replies:** 11\ **Last updated:** [May 31, 2019, 12:41am UTC](https://discuss.elastic.co/t/help-with-logstash-security-features/183597 "2019-05-31T00:41:42Z")
I just enabled on my elasticsearch 7.1 the security to login with user and passwords, but logstash stop working, im getting this error \[2019-05-30T12:58:41,053\]\[ERROR\]\[logstash.outputs.elasticsearch\] Encountered a retry… --- ## [Need help adding Fleet server](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565)
**Author:** [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Replies:** 18\ **Last updated:** [April 23, 2023, 2:52pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565 "2023-04-23T14:52:11Z")
I've installed the fleet server on my virtual Ubuntu version 22 machine but I can't get the fleet server to show in Kibana. I checked Ubuntu elastic-agent service and it was showing inactive so I started it with "systemc… --- ## [How to Delete (Hard Delete) document from Elasticsearch Disk?](https://discuss.elastic.co/t/how-to-delete-hard-delete-document-from-elasticsearch-disk/158351)
**Author:** [@HARSHAL\_CHAUDHARI](https://discuss.elastic.co/u/HARSHAL_CHAUDHARI)\ **Replies:** 10\ **Last updated:** [November 30, 2018, 6:38am UTC](https://discuss.elastic.co/t/how-to-delete-hard-delete-document-from-elasticsearch-disk/158351 "2018-11-30T06:38:55Z")
Hi, I am trying to delete a document from elastic search (using .Net NEST library), but a document is not deleted from a segment, just marked as deleted. (does not free the disk space.) Could you please let us know how… --- ## [Index Rollup delay effect](https://discuss.elastic.co/t/index-rollup-delay-effect/180383)
**Author:** [@mcguacon](https://discuss.elastic.co/u/mcguacon)\ **Replies:** 9\ **Last updated:** [May 23, 2019, 5:45pm UTC](https://discuss.elastic.co/t/index-rollup-delay-effect/180383 "2019-05-23T17:45:33Z")
I previously experimented with a rollup job that ran every 30 minutes, with an interval of 1 hour, and a delay of 12 hours. I wanted to experiment with rolling up older data. I have a new job that runs every 30 minutes… --- ## [Failed to create a new Beat](https://discuss.elastic.co/t/failed-to-create-a-new-beat/72675)
**Author:** [@romain.dequidt](https://discuss.elastic.co/u/romain.dequidt)\ **Replies:** 13\ **Last updated:** [February 5, 2017, 6:24pm UTC](https://discuss.elastic.co/t/failed-to-create-a-new-beat/72675 "2017-02-05T18:24:50Z")
Hi, I tried to follow the instructions from: https://www.elastic.co/guide/en/beats/libbeat/current/newbeat-generate.html I executed the following command: cookiecutter $GOPATH/src/github.com/elastic/beats/generat… --- ## [Sending e-mail with generated report fails](https://discuss.elastic.co/t/sending-e-mail-with-generated-report-fails/60263)
**Author:** [@Marten](https://discuss.elastic.co/u/Marten)\ **Replies:** 12\ **Last updated:** [September 16, 2016, 6:20am UTC](https://discuss.elastic.co/t/sending-e-mail-with-generated-report-fails/60263 "2016-09-16T06:20:27Z")
Hi there, I'm trying to use the new Reporting feature in combination with Watcher on Elastic Cloud. I want to generate a report and e-mail it to a whitelisted e-mail address. The report is being generated, which takes … --- ## [Errors when processing (mutating) date values](https://discuss.elastic.co/t/errors-when-processing-mutating-date-values/147345)
**Author:** [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Replies:** 13\ **Last updated:** [September 7, 2018, 7:19am UTC](https://discuss.elastic.co/t/errors-when-processing-mutating-date-values/147345 "2018-09-07T07:19:17Z")
We're attempting to import historical data in CSV format via Logstash, but it's choking on the date values. So far, we have the following config: input { stdin {} file { path =\> \["/Applications/logstash-6.2.4/data/… --- ## [Collapse performance with heavy operations](https://discuss.elastic.co/t/collapse-performance-with-heavy-operations/288085)
**Author:** [@DrParanoia](https://discuss.elastic.co/u/DrParanoia)\ **Replies:** 11\ **Last updated:** [November 4, 2021, 10:11am UTC](https://discuss.elastic.co/t/collapse-performance-with-heavy-operations/288085 "2021-11-04T10:11:30Z")
DISCLAIMER: I am relatively new to Elasticsearch, so I apologize in case my question is too "basic" or falls into "everybody should know this" category :smile: Hi! I have a performance question. Let's say, we have this … --- ## [Join two log files in logstash conf](https://discuss.elastic.co/t/join-two-log-files-in-logstash-conf/236306)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 15\ **Last updated:** [June 10, 2020, 8:57pm UTC](https://discuss.elastic.co/t/join-two-log-files-in-logstash-conf/236306 "2020-06-10T20:57:21Z")
i have an activity log like: 2020-06-02 03:30:50,712 USERID="(not logged in)" IP="103.226.146.203" SESSION="" HOST="h2t57-hrm.gh.pri" HOMEDIR="8.57" SITE="ps" METHOD="GET" HTTP\_USER\_AGENT="Mozilla/5.0 (Macintosh; Intel … --- ## [Header transform concern need help](https://discuss.elastic.co/t/header-transform-concern-need-help/269064)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 22\ **Last updated:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064 "2021-04-14T12:00:51Z")
I have an API POST that I want filebeat to contact. This API calls for having in the header the value: x-api-key : apiToken I have attempted the following \> request.transforms: - set: target: header … --- ## [X-pack PKI based authentication between elasticsearch and kibana](https://discuss.elastic.co/t/x-pack-pki-based-authentication-between-elasticsearch-and-kibana/112766)
**Author:** [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)\ **Replies:** 13\ **Last updated:** [December 22, 2017, 3:41am UTC](https://discuss.elastic.co/t/x-pack-pki-based-authentication-between-elasticsearch-and-kibana/112766 "2017-12-22T03:41:58Z")
Hi, I'm using X-Pack to secure ELK-Stack.I don't want to put plain text "username" and "password" in kibana.yml file. So I choose PKI(Public Key Infrastructure) based authentication.Getting some error while trying to es… --- ## [\[7.10.2\] Pending alerts when multiple instances of kibana](https://discuss.elastic.co/t/7-10-2-pending-alerts-when-multiple-instances-of-kibana/263583)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 10\ **Last updated:** [February 24, 2021, 2:48pm UTC](https://discuss.elastic.co/t/7-10-2-pending-alerts-when-multiple-instances-of-kibana/263583 "2021-02-24T14:48:13Z")
Hello. This thread is the translation of this one, this one and this issue that may be reopened when I'll have more clues So, I have created a brand new deployment on cloud.elastic.co. Created an alert on it with an ema… --- ## [Elasticsearch blocked futex](https://discuss.elastic.co/t/elasticsearch-blocked-futex/19953)
**Author:** [@Chris\_Denneen](https://discuss.elastic.co/u/Chris_Denneen)\ **Replies:** 10\ **Last updated:** [September 30, 2014, 7:05pm UTC](https://discuss.elastic.co/t/elasticsearch-blocked-futex/19953 "2014-09-30T19:05:11Z")
If anyone can help me understand why my cluster is hung I would appreciate it. jstack output: https://gist.github.com/anonymous/075c862cb211ae249707 I am able to query the cluster and health is good but I can'… --- ## [Logstash working on Linux but not on Windows](https://discuss.elastic.co/t/logstash-working-on-linux-but-not-on-windows/222530)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 20\ **Last updated:** [April 1, 2020, 6:06am UTC](https://discuss.elastic.co/t/logstash-working-on-linux-but-not-on-windows/222530 "2020-04-01T06:06:35Z")
I have Logstash config file with grok filters that work when I am passing logs from linux. But when logs are passed from windows, the filters arent being applied to it. below is my linux filebeat filebeat.inputs: - … --- ## [Kibana 7.14.2 Event Filter drop fails to drop events](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 12\ **Last updated:** [October 5, 2021, 5:38pm UTC](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763 "2021-10-05T17:38:01Z")
Kibana 7.14.2 is no longer dropping events that are in the events filter drop list. This is creating massive amounts of excessive unneeded data. 30+mil events per hour. In kibana, Elastic Security, Event filters section… --- ## [Extract field from url?](https://discuss.elastic.co/t/extract-field-from-url/181782)
**Author:** [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\ **Replies:** 10\ **Last updated:** [May 21, 2019, 3:46pm UTC](https://discuss.elastic.co/t/extract-field-from-url/181782 "2019-05-21T15:46:29Z")
I want to analyze AWS ELB logs, and I need to grep "instance" word from URL into a separate field, could you please provide an example, how to do it in filter section in logstash. Thanks logs: "GET https://cloude.compa… --- ## [Logstash parse out \\r and \\t entries](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 10\ **Last updated:** [August 10, 2018, 5:54pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888 "2018-08-10T17:54:33Z")
Hello there, I am having some issues with parsing out some logstash data. In my data, I have \\r's and \\t's that are floating around that I need to get rid of. \\tLogon ID:\\t\\t(0x2,0x50722C31)\\r I started trying to remo… --- ## [How to use \_source to create a scripted filter](https://discuss.elastic.co/t/how-to-use-source-to-create-a-scripted-filter/219646)
**Author:** [@wiouser](https://discuss.elastic.co/u/wiouser)\ **Replies:** 11\ **Last updated:** [February 20, 2020, 1:56pm UTC](https://discuss.elastic.co/t/how-to-use-source-to-create-a-scripted-filter/219646 "2020-02-20T13:56:28Z")
Hi I am trying to write a query to return documents which has the length of the log field more than 900. It is a text field. Running the below search I get variable \_source is not defined GET logdata/\_search { "query… --- ## [Snapshot issue to creating repo](https://discuss.elastic.co/t/snapshot-issue-to-creating-repo/71175)
**Author:** [@ankit2255](https://discuss.elastic.co/u/ankit2255)\ **Replies:** 9\ **Last updated:** [January 11, 2017, 6:10pm UTC](https://discuss.elastic.co/t/snapshot-issue-to-creating-repo/71175 "2017-01-11T18:10:43Z")
{ "error": { "root\_cause": \[ { "type": "repository\_verification\_exception", "reason": "\[es4\_backup\] \[\[SiVtYos-Qo-LRlL9UItz8A, 'RemoteTransportException\[\[tmz-mc2\]\[192.0.0.21:9300\]… --- ## [Elasticsearch dies every other day](https://discuss.elastic.co/t/elasticsearch-dies-every-other-day/18627)
**Author:** [@Klavs\_Klavsen](https://discuss.elastic.co/u/Klavs_Klavsen)\ **Replies:** 14\ **Last updated:** [September 10, 2014, 2:53pm UTC](https://discuss.elastic.co/t/elasticsearch-dies-every-other-day/18627 "2014-09-10T14:53:25Z")
my cluster - running 1.1.2 with oracle java 1.7\_55 - dies several days a week one the nodes gets "disconnected".. this time one of them logged: observer timed out. notifying listener. several times I then have to… --- ## [Index and lifecycle error and failed to rotate to warm phrase by ILM](https://discuss.elastic.co/t/index-and-lifecycle-error-and-failed-to-rotate-to-warm-phrase-by-ilm/227570)
**Author:** [@chunan](https://discuss.elastic.co/u/chunan)\ **Replies:** 13\ **Last updated:** [April 17, 2020, 11:13pm UTC](https://discuss.elastic.co/t/index-and-lifecycle-error-and-failed-to-rotate-to-warm-phrase-by-ilm/227570 "2020-04-17T23:13:57Z")
vector-diags-000005 failed to rotate. As you can see, 000004 was automatically rotated to 000005. But 000005 continued on to grow in size until it errors out. vector-diags-000005 3 P STARTED 1745886 262.8mb 192.16… --- ## [UK Post Code to geo data in Logstash?](https://discuss.elastic.co/t/uk-post-code-to-geo-data-in-logstash/43210)
**Author:** [@LeeSyd](https://discuss.elastic.co/u/LeeSyd)\ **Replies:** 9\ **Last updated:** [August 25, 2016, 8:13am UTC](https://discuss.elastic.co/t/uk-post-code-to-geo-data-in-logstash/43210 "2016-08-25T08:13:08Z")
I'm looking for a way to add Geo location data to documents based on UK post code (no IP data, address data only). I've searched but have been unable to find any results and have to admit that I am not a developer so a… --- ## [Java client 8.2.2 Trouble loading keystore during setup](https://discuss.elastic.co/t/java-client-8-2-2-trouble-loading-keystore-during-setup/307577)
**Author:** [@Jack\_Park](https://discuss.elastic.co/u/Jack_Park)\ **Replies:** 20\ **Last updated:** [June 26, 2022, 12:52am UTC](https://discuss.elastic.co/t/java-client-8-2-2-trouble-loading-keystore-during-setup/307577 "2022-06-26T00:52:52Z")
I created a gist here When doing a keystore.load I get DerInputStream.getLength(): lengthTag=87, too big. Apparently that's a rich topic, as in Most of the issue seems to be on platforms other than ES. I'm hoping … --- ## [Winlogbeat Fatal Error 8.7.0+ name already used](https://discuss.elastic.co/t/winlogbeat-fatal-error-8-7-0-name-already-used/337093)
**Author:** [@dwissm1](https://discuss.elastic.co/u/dwissm1)\ **Replies:** 12\ **Last updated:** [July 7, 2023, 12:33am UTC](https://discuss.elastic.co/t/winlogbeat-fatal-error-8-7-0-name-already-used/337093 "2023-07-07T00:33:28Z")
Hey Folks, Running into some fatal errors with Winlogbeat. Started happening around 8.7.0 and I am now getting to try to fix it. I was on 8.6.2 and and was working fine, anything 8.7+ it has a fatal error but if I go … --- ## [Filesearch solution using ES 5.5.0](https://discuss.elastic.co/t/filesearch-solution-using-es-5-5-0/94377)
**Author:** [@Ramon\_Zaro](https://discuss.elastic.co/u/Ramon_Zaro)\ **Replies:** 12\ **Last updated:** [August 2, 2017, 2:30pm UTC](https://discuss.elastic.co/t/filesearch-solution-using-es-5-5-0/94377 "2017-08-02T14:30:05Z")
Hi all, I am trying to set up a file searching capability for a not for profit org I am helping out. The use case is something like this : \*\*\* users drop documents (mainly doc files such as pdf, txt, xls, word but al… --- ## [Logstash not creating index in kibana](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780)
**Author:** [@kiran80511](https://discuss.elastic.co/u/kiran80511)\ **Replies:** 25\ **Last updated:** [August 20, 2021, 7:27am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780 "2021-08-20T07:27:08Z")
This is my logstash plain log file \[2021-06-18T08:21:45,675\]\[INFO \]\[logstash.runner \] Log4j configuration path used is: /etc/logstash/log4j2.properties \[2021-06-18T08:21:45,686\]\[INFO \]\[logstash.runner … --- ## [Logstash how to parse and split nested json file](https://discuss.elastic.co/t/logstash-how-to-parse-and-split-nested-json-file/305308)
**Author:** [@Iss](https://discuss.elastic.co/u/Iss)\ **Replies:** 9\ **Last updated:** [May 23, 2022, 10:52am UTC](https://discuss.elastic.co/t/logstash-how-to-parse-and-split-nested-json-file/305308 "2022-05-23T10:52:32Z")
Hi! I have a nested json file in a list read as single event in Elasticsearch like this : \[{"header": {"id": "idvalue", "datestamp": "YYYY-MM-DD" }, "metas": {"dc:title": "text...", "dc:id": "idvalue… --- ## [Entity/Identity resolution](https://discuss.elastic.co/t/entity-identity-resolution/11559)
**Author:** [@Yann\_Barraud](https://discuss.elastic.co/u/Yann_Barraud)\ **Replies:** 15\ **Last updated:** [September 12, 2013, 2:46pm UTC](https://discuss.elastic.co/t/entity-identity-resolution/11559 "2013-09-12T14:46:34Z")
Hi, I'm currently working on search engines, data cleaning and so on these last days. The challenge I'm facing right now is explaining that a search engine ((ie. ElasticSearch in this case) on its own can not be us… --- ## [Java search for lat/long fields](https://discuss.elastic.co/t/java-search-for-lat-long-fields/10287)
**Author:** [@Janusz\_Dalecki](https://discuss.elastic.co/u/Janusz_Dalecki)\ **Replies:** 20\ **Last updated:** [January 15, 2013, 10:23am UTC](https://discuss.elastic.co/t/java-search-for-lat-long-fields/10287 "2013-01-15T10:23:44Z")
Hi, I have a quite a few documents like this that are indexed in elasticsearch db (attached is just one for an example): { "took": 28, "timed\_out": false, "\_shards": { "total": … --- ## [Elasticsearch Boost Performance](https://discuss.elastic.co/t/elasticsearch-boost-performance/43722)
**Author:** [@arianayay](https://discuss.elastic.co/u/arianayay)\ **Replies:** 12\ **Last updated:** [March 15, 2016, 6:37am UTC](https://discuss.elastic.co/t/elasticsearch-boost-performance/43722 "2016-03-15T06:37:51Z")
Hi Everyone. I would like to ask what other configurations can I do to boost performance of Elasticsearch in terms of logs, data, backups and space or you can suggest anything? Since this can help in our research and per… --- ## [Short\_message nil value](https://discuss.elastic.co/t/short-message-nil-value/140123)
**Author:** [@PitoneMaledetto](https://discuss.elastic.co/u/PitoneMaledetto)\ **Replies:** 18\ **Last updated:** [July 25, 2018, 10:39am UTC](https://discuss.elastic.co/t/short-message-nil-value/140123 "2018-07-25T10:39:29Z")
Hi all, I am trying to send system metrics using metricbeat 6.3.0 to Logstash 6.3.0 but I am getting this error. Trouble sending GELF event {:gelf\_event=\>{"short\_message"=\>nil The issue seems to be that the short\_mess… --- ## [Old doc versions will not be deleted](https://discuss.elastic.co/t/old-doc-versions-will-not-be-deleted/246061)
**Author:** [@Messias\_2](https://discuss.elastic.co/u/Messias_2)\ **Replies:** 10\ **Last updated:** [August 24, 2020, 9:05pm UTC](https://discuss.elastic.co/t/old-doc-versions-will-not-be-deleted/246061 "2020-08-24T21:05:37Z")
Hi, in this discuss https://discuss.elastic.co/t/deleting-old-versions/4689/3 stands if you use the same ID for a doc: ... each time you index a doc with the same ID, the old version will be marked as deleted, and will … --- ## [ELasticSearch for high frequency update scenario](https://discuss.elastic.co/t/elasticsearch-for-high-frequency-update-scenario/354619)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 10\ **Last updated:** [March 4, 2024, 12:44pm UTC](https://discuss.elastic.co/t/elasticsearch-for-high-frequency-update-scenario/354619 "2024-03-04T12:44:25Z")
We have a scenario where in our domain entity undergoes very high frequency updates. Say a max of 100 updates for a domain entity in a minute. Currently we plan to index a summary of the domain information (few attribut… --- ## [Keyword type can't use field:(value1 value2) in querystring](https://discuss.elastic.co/t/keyword-type-cant-use-field-value1-value2-in-querystring/128279)
**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\ **Replies:** 11\ **Last updated:** [April 18, 2018, 3:51pm UTC](https://discuss.elastic.co/t/keyword-type-cant-use-field-value1-value2-in-querystring/128279 "2018-04-18T15:51:02Z")
I have a Keyword type field,and can use querystring field:(value1 OR value2) get the result,but if remove the 'OR' it return empty.even though i set default\_operator to "OR" in the querystring body,it still no effect,w… --- ## [One thread 100% CPU](https://discuss.elastic.co/t/one-thread-100-cpu/79743)
**Author:** [@xavier.tiendeo](https://discuss.elastic.co/u/xavier.tiendeo)\ **Replies:** 9\ **Last updated:** [March 24, 2017, 10:40am UTC](https://discuss.elastic.co/t/one-thread-100-cpu/79743 "2017-03-24T10:40:35Z")
We have 3 Nodes, we had these in hot threads: Hot threads at 2017-03-23T12:04:29.200Z, interval=500ms, busiestThreads=3, ignoreIdleThreads=true: 97.4% (487.1ms out of 500ms) cpu usage by thread 'elasticsearch\[p… --- ## [Node discovery issue post upgrade to newer version of ELK stack](https://discuss.elastic.co/t/node-discovery-issue-post-upgrade-to-newer-version-of-elk-stack/97741)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 17\ **Last updated:** [August 23, 2017, 1:52pm UTC](https://discuss.elastic.co/t/node-discovery-issue-post-upgrade-to-newer-version-of-elk-stack/97741 "2017-08-23T13:52:43Z")
I have migrated all my ELK nodes to new versions. I have 2 ES nodes with configs as below 10.\*\*\*.235 elk\_es\_crt\_00 cluster.name: csm\_elk\_es\_crt\_00 node.name: "elkescrt00.\*\*\*.net" bootstrap.memory\_lock: false networ… --- ## [How do i delete child docs in my parent-child relationship automatically in elasticsearch after a particular interval is finished](https://discuss.elastic.co/t/how-do-i-delete-child-docs-in-my-parent-child-relationship-automatically-in-elasticsearch-after-a-particular-interval-is-finished/197645)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 12\ **Last updated:** [September 2, 2019, 7:04am UTC](https://discuss.elastic.co/t/how-do-i-delete-child-docs-in-my-parent-child-relationship-automatically-in-elasticsearch-after-a-particular-interval-is-finished/197645 "2019-09-02T07:04:56Z")
link: https://stackoverflow.com/q/57704269/11432290 Can someone help me with this as i wanted to delete my child docs in my parent child relationship as described above in the link. Your guidance will be highly apprecia… --- ## [Logstash reads file with multiple lines as "1 hit"](https://discuss.elastic.co/t/logstash-reads-file-with-multiple-lines-as-1-hit/301191)
**Author:** [@RomanKau](https://discuss.elastic.co/u/RomanKau)\ **Replies:** 18\ **Last updated:** [May 24, 2022, 2:02pm UTC](https://discuss.elastic.co/t/logstash-reads-file-with-multiple-lines-as-1-hit/301191 "2022-05-24T14:02:21Z")
Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from logstash into elasticsearch and kibana works but when multiple files get read at the same time … --- ## [Snapshot/Restore VS ReIndexing - Missing documents, zero failures](https://discuss.elastic.co/t/snapshot-restore-vs-reindexing-missing-documents-zero-failures/354448)
**Author:** [@Joao\_Barreto](https://discuss.elastic.co/u/Joao_Barreto)\ **Replies:** 26\ **Last updated:** [March 5, 2024, 10:38am UTC](https://discuss.elastic.co/t/snapshot-restore-vs-reindexing-missing-documents-zero-failures/354448 "2024-03-05T10:38:04Z")
Hi everyone. A few weeks ago I created a post regarding a data migration I have to do in a customer with a Platinum License. The conclusion was that I needed to go from elastic 6 to 7 then to 8.12 in order to have the d… --- ## [Date times SQL and output differents values](https://discuss.elastic.co/t/date-times-sql-and-output-differents-values/217545)
**Author:** [@Mbt\_Mbt](https://discuss.elastic.co/u/Mbt_Mbt)\ **Replies:** 11\ **Last updated:** [February 3, 2020, 10:44pm UTC](https://discuss.elastic.co/t/date-times-sql-and-output-differents-values/217545 "2020-02-03T22:44:32Z")
Hi, Good afternoon, I am having problems viewing data of type date in kibana. I am using an elk platform with the jdbc connector. Where to make the query I get date type information. In the database I have the field … --- ## [Hosting Elastic Maps Service Locally with 7.12](https://discuss.elastic.co/t/hosting-elastic-maps-service-locally-with-7-12/270401)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 9\ **Last updated:** [May 3, 2021, 6:31pm UTC](https://discuss.elastic.co/t/hosting-elastic-maps-service-locally-with-7-12/270401 "2021-05-03T18:31:00Z")
I am trying to host elastic maps service locally with the new way to host the service on your my infrastructure. I have been following this guide Connect to Elastic Maps Service | Kibana Guide \[8.11\] | Elastic and have h… --- ## [Sonicwall firewall SIEM](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102)
**Author:** [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Replies:** 14\ **Last updated:** [May 10, 2022, 1:27pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102 "2022-05-10T13:27:52Z")
Hi there, I have already connected my Sonicwall firewall to Elastic Cloud (I'm in the trial). I can see the logs in Kibana, but Elastic Security SIEM doesn't recognize the Firewall as a host, so I it doesn't get the log… --- ## [Kibana server is not ready yet - All collectors are not ready. Waiting for 60000ms longer](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-all-collectors-are-not-ready-waiting-for-60000ms-longer/260864)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 11\ **Last updated:** [January 14, 2021, 11:52am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-all-collectors-are-not-ready-waiting-for-60000ms-longer/260864 "2021-01-14T11:52:01Z")
I succesfuly upgraded my 3\*nodes Elasticsearch cluster from 6.5.4 to 6.8.13 Then, I upgraded my Kibana server along the same path. Then no way to get kibana portal ... always displaying "Kibana server is not ready yet" … --- ## [Not able to get rid of circuit breaking exception](https://discuss.elastic.co/t/not-able-to-get-rid-of-circuit-breaking-exception/196233)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 9\ **Last updated:** [August 30, 2019, 8:34am UTC](https://discuss.elastic.co/t/not-able-to-get-rid-of-circuit-breaking-exception/196233 "2019-08-30T08:34:16Z")
Hi all, I am trying to index a 6 GB file to my cluster of three nodes. But i get circuit breaking exception every time. I have tried this increasing the limit by, "persistent" : { "indices.breaker.fielddata.limit" : "… --- ## [ECE URL Change](https://discuss.elastic.co/t/ece-url-change/187930)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 10\ **Last updated:** [July 8, 2019, 4:29pm UTC](https://discuss.elastic.co/t/ece-url-change/187930 "2019-07-08T16:29:30Z")
I'm looking at the ECE documentation, and "Change endpoint URLs" section is not clear to me. https://www.elastic.co/guide/en/cloud-enterprise/current/ece-administering-endpoints.html By default, cluster and Kibana endp… [Previous page](https://discuss.elastic.co/top.md?page=133&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=135&per_page=50&period=all)